On Fri, Jan 24, 2025 at 03:44:44PM +0000, Günther Noack wrote:
> * Fix some whitespace, punctuation and minor grammar
> * Add a missing sentence about the minimum ABI version,
> to stay in line with the section next to it
>
> Cc: Mickaël Salaün <mic@xxxxxxxxxxx>
> Cc: Tahera Fahimi <fahimitahera@xxxxxxxxx>
> Cc: Tanya Agarwal <tanyaagarwal25699@xxxxxxxxx>
> Signed-off-by: Günther Noack <gnoack@xxxxxxxxxx>
Looks good, thanks!
I'm going to take this patch in my tree with the changes explained
below. You can send a v2 with the second patch according to the reviews.
As a side note, applying the patch series from this thread with b4
doesn't work because they apply to different repositories.
Dealing with duplicated doc in two repositories is not practical and
adds work to everyone... Could we move the non-libc syscall man pages
to the kernel repository?
> ---
> Documentation/userspace-api/landlock.rst | 4 ++--
> include/uapi/linux/landlock.h | 6 ++++--
> 2 files changed, 6 insertions(+), 4 deletions(-)
>
> diff --git a/Documentation/userspace-api/landlock.rst b/Documentation/userspace-api/landlock.rst
> index d639c61cb472..ca8b325d53e5 100644
> --- a/Documentation/userspace-api/landlock.rst
> +++ b/Documentation/userspace-api/landlock.rst
> @@ -329,11 +329,11 @@ non-sandboxed process, we can specify this restriction with
> A sandboxed process can connect to a non-sandboxed process when its domain is
> not scoped. If a process's domain is scoped, it can only connect to sockets
> created by processes in the same scope.
> -Moreover, If a process is scoped to send signal to a non-scoped process, it can
> +Moreover, if a process is scoped to send signal to a non-scoped process, it can
> only send signals to processes in the same scope.
>
> A connected datagram socket behaves like a stream socket when its domain is
> -scoped, meaning if the domain is scoped after the socket is connected , it can
> +scoped, meaning if the domain is scoped after the socket is connected, it can
> still :manpage:`send(2)` data just like a stream socket. However, in the same
> scenario, a non-connected datagram socket cannot send data (with
> :manpage:`sendto(2)`) outside its scope.
> diff --git a/include/uapi/linux/landlock.h b/include/uapi/linux/landlock.h
> index 33745642f787..048a2c77c4eb 100644
> --- a/include/uapi/linux/landlock.h
> +++ b/include/uapi/linux/landlock.h
> @@ -268,7 +268,7 @@ struct landlock_net_port_attr {
> * ~~~~~~~~~~~~~~~~
> *
> * These flags enable to restrict a sandboxed process to a set of network
> - * actions. This is supported since the Landlock ABI version 4.
> + * actions. This is supported since Landlock ABI version 4.
If that's OK with you, I'll move this sentence to a standalone paragraph
like the one you added below:
+ * actions.
+ *
+ * This is supported since Landlock ABI version 4.
> *
> * The following access rights apply to TCP port numbers:
> *
> @@ -291,11 +291,13 @@ struct landlock_net_port_attr {
> * Setting a flag for a ruleset will isolate the Landlock domain to forbid
> * connections to resources outside the domain.
> *
> + * This is supported since Landlock ABI version 6.
> + *
> * Scopes:
> *
> * - %LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET: Restrict a sandboxed process from
> * connecting to an abstract UNIX socket created by a process outside the
> - * related Landlock domain (e.g. a parent domain or a non-sandboxed process).
> + * related Landlock domain (e.g., a parent domain or a non-sandboxed process).
> * - %LANDLOCK_SCOPE_SIGNAL: Restrict a sandboxed process from sending a signal
> * to another process outside the domain.
> */
> --
> 2.48.1.262.g85cc9f2d1e-goog
>
>
